Start with built-in controls.

1. Open Settings.
2. Tap Screen Time.
3. Turn it on. On iOS 27, tap Screen Time Schedule, Time Allowances or Manage Screen Time, then Turn On App & Website Activity. On iOS 26, tap App & Website Activity and turn it on; older versions have a single Turn On Screen Time button.
4. Tap Lock Screen Time Settings. On iOS 27 it is under Passcode & Management, reached through Manage Screen Time on some builds. On iOS 26 it is further down the main Screen Time screen, and older versions call it Use Screen Time Passcode.
5. Let the trusted person enter a passcode you do not know, if you are using the self-lockout model.
6. When iOS asks for an Apple Account for Screen Time Passcode Recovery, enter the trusted person's Apple Account, not your own, and only if its password is one you have never seen. Skipping the prompt is the stronger choice, at a cost: with no recovery account there is no supported reset, and the only way past a forgotten passcode is to erase the device, so the trusted person must store it well. Apple's iOS 27 page describes only the recovery-account route, so test your own version once: set a throwaway passcode, skip recovery, and confirm the change-passcode flow cannot get past the account step. See The trusted person.

1. Open Settings -> Screen Time.
2. On iOS 27, tap Apps & Websites, then Restrictions, then Filtering under Websites. On iOS 26, tap Content & Privacy Restrictions, turn it on, tap App Store, Media, Web, & Games (or Content Restrictions on some versions), then Web Content.
3. Choose Limit Adult Websites for the normal adult-content block.
4. Choose Approved Websites Only (iOS 26: Only Approved Websites; older versions: Allowed Websites Only) for allowlist mode, which is the stronger option. See Allowlist mode for what it covers and what it costs day to day.
5. Add domains that are personally risky for you to the blocked list: the Blocked list in Apps & Websites on iOS 27, Never Allow under Web Content on iOS 26.
6. Turn on Content & Privacy Restrictions as well if your version shows it as a switch. The web filter no longer lives there on iOS 27, but the app-rating limit and the Allow Changes locks in the next guide do, and on iOS 26 the passcode protection for blocker apps needs it on.
7. Test in Safari, then test in every other browser still installed.

1. On iOS 27, open Screen Time -> Apps & Websites -> Restrictions and find the App Store section. On iOS 26, go back to Content & Privacy Restrictions and open App Installations & Purchases (older versions: iTunes & App Store Purchases, reached through App Store, Media, Web, & Games).
2. Set Installing Apps to Blocked (iOS 26: Don't Allow).
3. Set App Marketplaces to Blocked or Don't Allow if shown. In the EU, Japan and Brazil this is a second install path, and leaving it open lets you sideload a browser around the block.
4. Set Deleting Apps to Blocked or Don't Allow if deleting the blocker or browser is a bypass.
5. Set In-app Purchases to Blocked or Don't Allow if spending or subscriptions are part of the problem.
6. Turn off apps you do not want available: on iOS 27 add them to the Blocked list in Apps & Websites, or switch built-in features off under Content & Privacy Restrictions -> Other Features; on iOS 26 use Allowed Apps & Features. Note that turning Safari off only hides the icon: web pages opened inside other apps keep working, so this is not a web block on its own. The web filter from the previous guide is the one that reaches those views.
7. Under Content & Privacy Restrictions -> Allow Changes (iOS 26: Allow Changes To; older versions list each item on its own), set Passcode & Face ID (older: Passcode Changes) to Don't Allow.
8. Set Accounts (older: Account Changes) to Don't Allow.
9. Set Cellular Data (older: Cellular Data Changes) to Don't Allow if switching networks is part of the bypass.

For serious lockout, Screen Time alone is not enough if you can recover the passcode yourself. Use the Trusted person handoff.

Blockers built on Apple's Screen Time framework (Opal, Jomo, ScreenZen, Brick, one sec, Refocus and others) ask for Screen Time access when first opened. Their blocks are enforced by iOS, so they hold when the app is closed, and since iOS 26.4 switching that access off under Settings -> Screen Time -> Apps with Screen Time Access can require the Screen Time passcode, provided Lock Screen Time Settings and Content & Privacy Restrictions are both on. With Deleting Apps set to Don't Allow, that is the first time a third-party blocker on an unsupervised iPhone genuinely resists self-removal.

1. Pick a blocker with a strict mode that a second person can hold, and let the trusted person set its PIN.
2. Confirm the protection on your device, from both places: Settings -> Screen Time -> Apps with Screen Time Access, and Settings -> Apps -> the blocker -> its Screen Time switch. On iOS 26.4 to 26.6 the second route accepted Face ID or the device passcode for many users; iOS 27 is reported to ask for the Screen Time passcode on both. If either route lets you through without it, the blocker is not protected yet.
3. Turn off Share Across Devices unless every device on the account is set up just as strictly.
4. Set the Apps rating limit to 16+ or lower: on iOS 27 under Content & Privacy Restrictions -> Content Restrictions, on iOS 26 under App Store, Media, Web, & Games. Since iOS 26 apps are rated 13+, 16+ and 18+, and the web filter does not reach what native apps show in their own feeds.

The full stack, and how it fits with the DNS profile, is in what actually holds on an unsupervised iPhone.

1. Install Google Family Link on the parent or trusted person's device.
2. Sign in with the parent Google Account.
3. On the managed Android phone or tablet, sign in with the supervised Google Account.
4. Follow the prompts to link the device to Family Link.
5. Do not save the parent Google password on the managed device.
6. Remove any second Google Account that can install apps or change settings without approval.

1. On the parent device, open Family Link.
2. Select the supervised account.
3. Tap Controls.
4. Tap Google Chrome and Web (older versions call it Google Chrome or Chrome & Web).
5. Choose Try to block explicit sites for the normal filter.
6. Choose Only allow approved sites for whitelist mode.
7. Add known risky domains to Blocked sites.
8. Turn on SafeSearch for Google Search.
9. Turn on Restricted Mode for YouTube, then test the YouTube app and YouTube in the browser.

Chrome filtering is not the same thing as whole-device filtering. If another browser, VPN, or private DNS setting remains available, add the Android Friction steps.

1. In Family Link, open Controls -> Google Play.
2. Set content restrictions for apps, games, movies, books, and purchases.
3. Require approval for new app installs and purchases.
4. Uninstall extra browsers, VPN apps, proxy apps, and app stores you do not need.
5. Check Settings -> Apps for browsers hidden under unfamiliar names.
6. Open Settings -> Network & internet -> Private DNS and note whether a DNS layer is already set.
7. Test over Wi-Fi and mobile data. A router filter will not protect mobile data.

1. Set up the Chromebook with the account that should be the owner, ideally the trusted person's account for stronger lockout.
2. Add the supervised account that will be used daily.
3. Use Family Link for that supervised account. Note the age limit described in the Android section: an adult account cannot be supervised.
4. Do not use the owner account for daily browsing.
5. Do not save the owner or parent password where the daily user can access it.

1. Sign in as the Chromebook owner.
2. Open Settings.
3. Open Privacy and security. On older builds this is Security and Privacy.
4. Open Manage other people.
5. Turn off Guest browsing.
6. Turn on Limit who can sign-in. On older builds this is Restrict sign-in to the following users.
7. Add only the accounts that should be allowed on the device.
8. Sign out and confirm that guest mode is no longer available from the login screen.

1. On the parent or trusted person's device, open Family Link.
2. Select the supervised account.
3. Open Controls -> Google Chrome and Web (older versions call it Google Chrome or Chrome & Web).
4. Choose Try to block explicit sites or Only allow approved sites.
5. Open Advanced settings and turn off Permissions for sites and Extensions. Family Link has no controls for downloads, pop-ups or notifications.
6. Test the daily account, then try to sign in as a different account and confirm it is blocked.

For school or organization-grade control, use Chrome Enterprise or another managed-device setup instead of relying only on a personal owner account.

1. Go to account.microsoft.com/family.
2. Sign in with the organizer account.
3. Add the managed Microsoft account as a family member.
4. On the Windows PC, sign in with the managed account.
5. Open Settings -> Accounts -> Family or Family & other users.
6. Confirm the managed account is a Standard User, not an administrator.
7. Use a separate administrator account for setup and recovery.

1. Open the Family Safety dashboard.
2. Select the family member.
3. Open Content filters.
4. Turn on Filter inappropriate websites and searches.
5. Turn on Only use allowed websites if you want whitelist mode.
6. Add personally risky domains to the blocked list.
7. Use Microsoft Edge for the managed account.
8. Set Edge as the default browser.
9. Test the filter in Edge and then test any other installed browser.

Microsoft Family Safety web filtering is Edge-centered. Microsoft's documentation says that when Filter inappropriate websites and searches is on, unsupported browsers are blocked so the filter cannot be bypassed, and that a browser can be manually unblocked on the device under App and game filters. Still verify it on the actual device: portable browsers, less common browsers, and any session where the managed account is not signed in can still get through. If Chrome, Firefox, Brave, portable browsers, or app stores remain available, add the Windows Friction steps.

1. In Family Safety, open Apps and games.
2. Set age limits and app restrictions.
3. Remove extra browsers from the standard account.
4. Open Settings -> Apps and uninstall browsers or stores you do not need.
5. Keep the Microsoft Store and installer approvals under the organizer or administrator account.
6. Do not type the admin password into prompts while the daily user is watching or recording it.

1. Open System Settings.
2. Click Screen Time.
3. Turn it on. On macOS 27, click Screen Time Schedule, Time Allowances or Manage Screen Time, then Turn On App & Website Activity. On macOS 13 to 26, turn on App & Website Activity; older versions have a single Screen Time on/off switch.
4. Scroll down and turn on Lock Screen Time Settings, which sets the Screen Time passcode. On macOS 27 it sits below the schedule and allowance items, next to Share across devices.
5. Let the trusted person hold the passcode if this is a self-lockout setup.
6. As on iPhone, if macOS offers an Apple Account for passcode recovery, either enter the trusted person's account or skip it, never your own. The same trade-off applies: with no recovery account, a forgotten passcode has no reset path.

1. In System Settings, open Screen Time.
2. Open Content & Privacy Restrictions (macOS 13 to 26: Content & Privacy) and turn it on.
3. Open App Store, Media, Web, & Games, then find the Safari section. macOS labels this section Safari, not Web Content as on iPhone. Apple's macOS 27 guide still lists it here; if your Mac shows it somewhere else, look under Apps & Websites and tell us.
4. Set it to Limit Adult Websites.
5. Use Allowed Websites Only if you want whitelist mode. On macOS each entry needs both a title and a URL.
6. Tighten app, movie, TV, book, and store restrictions where relevant.
7. Open App & Feature Restrictions. On the Mac itself only Camera, Book Store, Siri & Dictation and SharePlay can be switched off here; the Safari, Mail and AirDrop entries under Allowed on iOS affect a family member's iPhone or iPad, not this Mac.
8. Know what Preference Restrictions does not do: its Allow Changes list (Passcode, Account, Cellular Data and the rest) applies only to iOS and iPadOS devices in a family, and changes nothing on the Mac. The Mac's equivalent lock is a standard daily account with the administrator password held by someone else, in the next guide.

1. Open System Settings -> Users & Groups.
2. Create a new standard account for daily use, or convert the daily account to standard after creating a separate admin account.
3. Keep one administrator account for maintenance.
4. Have the trusted person hold the administrator password if you need lockout.
5. Use the standard account for daily browsing and work.
6. Test app installation, browser installation, and Screen Time changes from the standard account.

Expect the browser-installation test to fail, in the sense that it will succeed. A standard account on macOS still lets you put an app in your own home folder or run one from Downloads. The standard account is worth doing because it protects system-wide changes such as hosts files, profiles, and policy, but it is not an app-install block. Apple's own guidance reflects this: enabling Lock Screen Time Settings prompts you to convert an administrator account to standard, because Screen Time was never designed to hold against an admin.

macOS has no allowlist of permitted applications in the normal settings. The old Parental Controls feature that did this was retired, and the current App & Feature Restrictions pane covers only a handful of Apple features, none of them third-party apps. The one usable lever is a time limit: Time Allowances on macOS 27, App Limits on macOS 13 to 26.

1. On macOS 27, open System Settings -> Screen Time -> Time Allowances, use Manage Categories to add a category containing only that browser, and set its allowance to the minimum. On macOS 13 to 26, open App Limits, add a limit for the browser, and set it to the minimum (zero on macOS 26, one minute before that).
2. On macOS 13 to 26, turn on Block at end of limit; without it the limit is only a notification. macOS 27 has no such switch, so test it: when the allowance runs out, the browser should refuse to open without the passcode.
3. Confirm a Screen Time passcode is set, held by the trusted person. Without a passcode the block can be dismissed.